Hello all. My question is brief but will most likely illicit a very broad response as I hope it will. I am in the process of asking my agency for digital forensic training. With the issue of funding aside, as I can ask for what ever I want and have it denied due to a tight budget, which should be the first certification/training I should ask for?
My background consists of doing some forensics with Encase V6 and some Linux tools. I have been to two entry level schools, Basic Data Recovery and Acquisition and Intermediate Data Recovery and Acquisition presented by the National White Collar Crimes Center.
Hello all. My question is brief but will most likely illicit a very broad response as I hope it will.
illicit? 😯
Your spell checker must have tricked you… wink
jaclaz
LOL ELICIT …. sorry all!
This is my experience only.
I've attended many Guidance Software trainings in the past. My experience with them is while it is good stuff, they don't update the content very much. I haven't been in a couple years so don't know if they finally caught up.
Currently, I do the SANS training just to hone up on Windows 8 or current methods for memory analysis. I recently completed FOR 408 and am halfway through FOR 508. The advantage with SANS, for me, is their on demand stuff. At least I think it's an advantage because I keep getting pulled away to work on my other duties which breaks my concentration. Anyway, they are current with the OS and memory analysis. I can't attest to how often they update though. They're not cheap by any stretch of the imagination though.
For certifications you may also want to look at the cce or cfce.
Training look at getting trained on the tools you use ie EnCase, AccessData, XWays, and or ILook and their certifications.
Others
Nw3c training
Sans training.
Apple forensic training.
Mobile device tool training.
All the best
Chris
I would highly recommend the CFCE from IACIS. Depending on experience, this can be done as an external candidate (do no need to attend the training). It is relatively low cost, however is a lot of work and committment to time. It consists of four practicals and two examinations and will test your knowledge leading to lots of researching in references and on the Internet. You are provided a mentor/coach for the practicals who will make sure that you are on the right track. At the end, you will be very comfortable with FAT and NTFS file systems. Both are examined at the byte level and I would highly recommend something like the LockandCode Quick Reference Guide.
Once certified you can add to the experience by volunteering to be a coach/mentor and or correcting examinations. I have found it to be a worthwhile experience.
What are your career goals and/or path? Also, what types of cases does your agency usually see?
My goal is to become a great digital forensic examiner. My cases primarily consist of online child exploitation incidents and dead box examinations. I also investigate frauds and want to learn more about live box forensics and incident response. The good thing about working for a police department is that i get a lot of variety to attempt to apply what I learn.